> TODAY'S SUMMARY (110 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Cybercriminals are increasingly targeting everyday users with spyware, indicating a shift towards more indiscriminate attacks. Additionally, vulnerabilities in widely used platforms like SAP and Google Chrome have been actively exploited, with SAP releasing critical patches for multiple flaws. The Russian state-linked Turla group continues to pose a threat, using advanced tools like "Cereal" to intercept emails from government servers. Meanwhile, supply chain attacks remain a concern, evidenced by the recent Qubole incident, which compromised numerous organizations' credentials. Overall, the rise in cloud vulnerabilities and the exploitation of AI in cyberattacks are emerging as critical areas for organizations to address.
|
// AI-powered summary generated at 16:00
On June 10th, 2025, we received a submission for a Remote Code Execution vulnerability in Sneeit Framework, a WordPress plugin with an estimated 1,700 active installations. The plugin is bundled in multiple premium themes. This vulnerability can be leveraged to execute code remotely.
The post Attack...
A critical security flaw impacting a WordPress plugin known as King Addons for Elementor has come under active exploitation in the wild.
The vulnerability, CVE-2025-8489 (CVSS score: 9.8), is a case of privilege escalation that allows unauthenticated attackers to grant themselves administrative priv...
Google is expanding support for its Android's in-call scam protection to multiple banks and financial applications in the United States. [...]
Posted by Aden Haussmann, Associate Product Manager and Sumeet Sharma, Play Partnerships Trust & Safety Lead
Android uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle. Over the last few years, we’ve launched industry-leading features to dete...
Ghostscript could be made to crash if it wrote certain files.
Microsoft has silently "mitigated"Â a high-severity Windows LNK vulnerability exploited by multiple state-backed and cybercrime hacking groups in zero-day attacks. [...]
A fresh wave of spear-phishing linked to the Russia-based Star Blizzard group has been detected by Sekoia
The cameras, made by the police technology juggernaut Axon Enterprise, were deployed on a trial basis by as many as 50 officers on Wednesday, according to local news reports.
Some 2FA-phishing attacks are becoming significantly harder to spot as threat actors blend two previously distinct phishing-as-a-service (PhaaS) kits: Salty2FA and Tycoon2FA, into a single hybrid strain.
Researchers at Any.Run warn that the hybrid is already bypassing detec...
A new cyber defense service has prevented almost one billion early-stage cyber-attacks in the past year, British Security Minister claims
Salt Security announced it is extending its API behavioral threat protection to detect and block malicious intent targeting Model Context Protocol (MCP) servers deployed within the AWS ecosystem. Building on the recent launch of Salt’s MCP Finder technology, Salt now enables organizations to identif...
Earlier this year, one of the largest crypto exchanges in South Korea detected abnormal withdrawal activity from one of its…
The post $35 Million in Crypto Drained in 15 Minutes: How Exchange Hacks Are Evolving and How to Prevent Them appeared first on Chainalysis.
Attackers are using a tool called Evilginx to steal session cookies, letting them bypass the need for a multi-factor authentication (MFA) token.
Personal Information of 33.7 Million Stolen From Coupang South Korea’s Coupang disclosed a five‑month data breach in which attackers accessed names, addresses, email addresses, phone numbers, and order history for about 33.7 million customers. The breach began in late June and was only detected in m...
Mobile phone makers will no longer be required to load the Indian government's Sanchar Saathi app onto new devices after the initial announcement prompted pushback from companies and privacy groups.
Oxygen Forensic® Detective v18.1 is now out, bringing new extraction options, artifact support, and a dedicated cryptocurrency section.
The FBI has recently issued a public service announcement that warns that since January 2025 there have been more than 5,100 complaints of account takeover fraud, and total reported losses in excess of US $262 million.
Read more in my article on the Fortra blog.
Bitwarden announced Bitwarden Access Intelligence for Enterprise plans. Access Intelligence provides visibility into weak, reused, or exposed credentials across critical applications, with guided remediation workflows for consistent credential updates at scale. The capability helps IT and security t...
Several security issues were fixed in PostgreSQL.
The threat actor known as Water Saci is actively evolving its tactics, switching to a sophisticated, highly layered infection chain that uses HTML Application (HTA) files and PDFs to propagate a worm that deploys a banking trojan via WhatsApp in attacks targeting users in Brazil.
The latest wave is...