Threat actors have been observed targeting Internet Information Services (IIS) servers in Asia as part of a search engine optimization (SEO) manipulation campaign designed to install BadIIS malware. “It is… Read More »DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects
Zimbra has released software updates to address critical security flaws in its Collaboration software that, if successfully exploited, could result in information disclosure under certain conditions. The vulnerability, tracked as… Read More »Zimbra Releases Security Updates for SQL Injection, Stored XSS, and SSRF Vulnerabilities
Threat actors have been observed exploiting multiple security flaws in various software products, including Progress Telerik UI for ASP.NET AJAX and Advantive VeraCore, to drop reverse shells and web shells,… Read More »XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells
Cybersecurity researchers have uncovered two malicious machine learning (ML) models on Hugging Face that leveraged an unusual technique of “broken” pickle files to evade detection. “The pickle files extracted from… Read More »Malicious ML Models on Hugging Face Leverage Broken Pickle Format to Evade Detection
A new audit of DeepSeek’s mobile app for the Apple iOS operating system has found glaring security issues, the foremost being that it sends sensitive data over the internet sans… Read More »DeepSeek App Transmits Sensitive User and Device Data Without Encryption
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a security flaw impacting Trimble Cityworks GIS-centric asset management software has come under active exploitation in the wild. The… Read More »CISA Warns of Active Exploits Targeting Trimble Cityworks Vulnerability
India’s central bank, the Reserve Bank of India (RBI), said it’s introducing an exclusive “bank.in” internet domain for banks in the country to combat digital financial fraud. “This initiative aims… Read More »India’s RBI Introduces Exclusive “bank.in” Domain to Combat Digital Banking Fraud
Microsoft is warning of an insecure practice wherein software developers are incorporating publicly disclosed ASP.NET machine keys from publicly accessible resources, thereby putting their applications in attackers’ pathway. The tech… Read More »Microsoft Identifies 3,000+ Publicly Disclosed ASP.NET Machine Keys Vulnerable to Code Injection
The foundations for social engineering attacks – manipulating humans – might not have changed much over the years. It’s the vectors – how these techniques are deployed – that are… Read More »AI-Powered Social Engineering: Reinvented Threats
Threat actors have been observed exploiting recently disclosed security flaws in SimpleHelp’s Remote Monitoring and Management (RMM) software as a precursor for what appears to be a ransomware attack. The… Read More »Hackers Exploiting SimpleHelp RMM Flaws for Persistent Access and Ransomware