The hack of 120 000 IP cameras across South Korea led to the production and sale of sexually explicit footage. We break down how IP cameras work — and how to secure them.
Illia Volochii discovered that urllib3 did not limit the steps in a
decompression chain. An attacker could possibly use this issue to cause
urllib3 to use excessive resources, causing a denial of service.
(CVE-2025-66418)
Rui Xi discovered that urllib3 incorrectly handled highly compressed data.
An...
A new variation of the ClickFix attack dubbed 'ConsentFix' abuses the Azure CLI OAuth app to hijack Microsoft accounts without the need for a password or to bypass multi-factor authentication (MFA) verifications. [...]
AI-driven attacks now automate reconnaissance, generate malware variants, and evade detection at a speed that overwhelms traditional defenses. Corelight explains how network detection and response (NDR) provides the visibility and behavioral insights SOC teams need to spot and stop these fast-moving...
c-ares could be made to crash if it received specially crafted queries.
The Information Commissioner’s Office said LastPass had “failed to implement sufficiently robust technical and security measures” to protect its data.
This is a predictions blog. We know, we know; everyone does them, and they can get a bit same-y. Chances are, you’re already bored with reading them. So, we’ve decided to do things a little bit differently this year. Instead of bombarding you with just our own predictions, we’ve decided to cast the...
Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens
and s3tokens APIs. A remote attacker could possibly use this issue to
obtain unauthorized access and escalate privileges. (CVE-2025-65073)
It was discovered that OpenStack Keystone only validated the first 72
bytes of an appli...
Danielle Hillmer allegedly concealed the fact that her employer’s cloud platform did not meet DoD requirements.
The post Former Accenture Employee Charged Over Cybersecurity Fraud appeared first on SecurityWeek.
Deep dive into CyberVolk’s new VolkLocker ransomware-as-a-service, its major design flaw, and what it signals for cyber defenders.
This release delivers deeper integrations, dramatically faster analysis, and unmatched support for the latest, most popular languages, helping your team embrace the “vibe, then verify” philosophy.
The post SonarQube Server 2025.6 is here: Vibe, then verify faster than ever appeared first on Security...
SonarQube provides an intelligent, high-precision, and integrated solution for development teams to achieve full, friction-free compliance with the MISRA C++:2023 coding standard for C++17 safety-critical applications.
The post The intelligent approach to achieve MISRA C++:2023 compliance appeared f...
Eleven companies took part in the evaluations and several have boasted 100% detection and coverage rates.
The post MITRE Posts Results of 2025 ATT&CK Enterprise Evaluations appeared first on SecurityWeek.
This week’s cyber stories show how fast the online world can turn risky. Hackers are sneaking malware into movie downloads, browser add-ons, and even software updates people trust. Tech giants and governments are racing to plug new holes while arguing over privacy and control. And researchers keep u...
Say hello to the upgraded Malwarebytes for Mac, with stronger protection and more control.
Cellebrite’s acquisition of Corellium unites leading virtualization and digital investigation capabilities to deliver an unmatched, end-to-end platform for intelligence, security and forensics.
The founder of Freedom Chat said the company has reset user PINs and released a new version to app stores.
An unpatched zero-day vulnerability in Gogs, a popular self-hosted Git service, has enabled attackers to gain remote code execution on Internet-facing instances and compromise hundreds of servers. [...]
Cybersecurity researchers have disclosed details of a new fully-featured Windows backdoor called NANOREMOTE that uses the Google Drive API for command-and-control (C2) purposes.
According to a report from Elastic Security Labs, the malware shares code similarities with another implant codenamed FINA...
AppSec teams are under constant pressure to secure fast-moving applications without slowing anything down. But scanning windows, fragile authentication, and sprawling API estates often get in the way