A 25-year-old man who helped steal nearly $260,000 in cryptocurrency through a SIM-swapping fraud scheme was sentenced to two and a half years in prison at a London court.
The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.
The post Cisco Patches a Dozen Critical Vulnerabilities appeared first on SecurityWeek.
Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches. [...]
The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN.
According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company...
Learn how stolen business credentials reach the dark web, why delayed exposure creates risk, and what to do when accounts are compromised.
The hackers alerted the fashion giant's customers through a push notification that said they had "fully compromised" the company's cloud storage.
SPONSORED FEATURE: Old attack, new protections
In leaked chats, members track dozens of victims, haggle over multimillion-dollar payments and direct operatives based in the United States whom they call “agents.”
Attackers compromised .gh, .sl and .as registries to obtain unauthorized HTTPS certificates
All enterprises conduct security awareness training for their employees. But whether this has tangible benefits is debatable.
The post Security Awareness Training Isn’t Dead, but It Needs a Rethink appeared first on SecurityWeek.
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks.
The activity, per CrowdStrike Intelligence, was active from late September to early...
Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products.
The post Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication appeared first on SecurityWeek.
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting forgotten OAuth grants to gain access to corporate data. This article...
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
Two of South Korea's largest Protestant churches are investigating cyberattacks that may have exposed sensitive information about hundreds of thousands of members, including personal details, financial records and internal documents.
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.