Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption… Read More »Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online – Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first… Read More »Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance’s operating system, Cisco said in an advisory on Wednesday.… Read More »Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea’s fraudulent remote IT worker… Read More »U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while… Read More »How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client’s memory, and the researcher who reported it turned that into code execution… Read More »curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version… Read More »CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an… Read More »An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from… Read More »Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web… Read More »Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days